4 ms·
Interestingly, it also doesn't allow the CA that it's serving, at least per the CAA records: w3.org. 3599 IN SOA ns1.w3.org. hostmaster.w3.or
by raggi 5y ago
Interestingly, it also doesn't allow the CA that it's serving, at least per the CAA records:
w3.org. 3599 IN SOA ns1.w3.org. hostmaster.w3.org. (
2021060201 ; serial
28800 ; refresh (8 hours)
3600 ; retry (1 hour)
604800 ; expire (1 week)
1800 ; minimum (30 minutes)
)
w3.org. 3599 IN CAA 0 issuewild "sectigo.com"
w3.org. 3599 IN CAA 0 iodef "mailto:sysreq@w3.org"
w3.org. 3599 IN CAA 0 issue "amazon.com"
w3.org. 3599 IN CAA 0 issue "sectigo.com"
w3.org. 3599 IN CAA 0 issue "letsencrypt.org"
It does look like the records were updated recently.
The spf records are also interesting, but I know nothing about their mail setup.
A new Gandi cert was just issued: https://crt.sh/?id=4630660228 https://crt.sh/?id=4630660228
Perhaps it just needs a kick, or it'll be fixed soon.
- bawolff 5y agoCAA only applies at time of issue. Its totally valid for your CAA records to not match the cert you are using, as long as CAA was ok at issue time.
- raggi 5y agoWhich it appears that it was not, at the time that cert was issued! I have no idea if CAB have made CAA a requirement, but I presume not.